CVE-2025-6488 is a stored cross-site scripting vulnerability in the isMobile() Shortcode plugin for WordPress by jairoochoa. The flaw exists in the handling of the ‘device’ parameter, which lacks proper input sanitization and output escaping. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject arbitrary web scripts that execute in the context of users visiting the compromised pages. This vulnerability affects all versions up to 1.1.1. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with Contributor-level access or higher can inject persistent malicious scripts into pages via the ‘device’ parameter. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions within the context of the affected site. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the isMobile() Shortcode plugin if it is not essential. Monitor for plugin updates from the vendor that address this vulnerability.